【计算机工具类-安全工具Skills】azure-security-keyvault-keys-dotnet 技能

Azure Key Vault Keys SDK for .NET。用于在Azure Key Vault和Managed HSM中管理加密密钥的客户端库。用于密钥创建、轮换、加密、解密、签名和验证。技能概述azure-security-keyvault-keys-dotnet 技能是用于管理Azure Key Vault和Managed HSM中加密密钥的.NET客户端库。该SDK提供了完整的密钥生命周期管理功能包括密钥创建、更新、删除、备份和恢复以及加密、解密、签名和验证等加密操作。下载地址https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-security-keyvault-keys-dotnet主要功能密钥管理: 创建、获取、更新和删除RSA、EC和OCT密钥加密操作: 加密、解密、包装和解包密钥签名验证: 对数据进行签名和验证签名密钥轮换: 自动和手动密钥轮换备份恢复: 备份和恢复密钥HSM支持: 支持硬件安全模块HSM保护的密钥密钥解析: 通过密钥ID解析和获取CryptographyClient安装dotnet add package Azure.Security.KeyVault.Keys dotnet add package Azure.Identity客户端层次结构KeyClient (密钥管理)├── CreateKey / CreateRsaKey / CreateEcKey├── GetKey / GetKeys├── UpdateKeyProperties├── DeleteKey / PurgeDeletedKey├── BackupKey / RestoreKey└── GetCryptographyClient() → CryptographyClientCryptographyClient (加密操作)├── Encrypt / Decrypt├── WrapKey / UnwrapKey├── Sign / Verify└── SignData / VerifyDataKeyResolver (密钥解析)└── Resolve(keyId) → CryptographyClient创建密钥示例// 创建RSA密钥KeyVaultKey rsaKey await client.CreateKeyAsync(my-rsa-key, KeyType.Rsa);// 创建带选项的RSA密钥var rsaOptions new CreateRsaKeyOptions(my-rsa-key-2048){KeySize 2048,HardwareProtected false,ExpiresOn DateTimeOffset.UtcNow.AddYears(1),Enabled true};rsaOptions.KeyOperations.Add(KeyOperation.Encrypt);rsaOptions.KeyOperations.Add(KeyOperation.Decrypt);KeyVaultKey rsaKey2 await client.CreateRsaKeyAsync(rsaOptions);// 创建EC密钥var ecOptions new CreateEcKeyOptions(my-ec-key){CurveName KeyCurveName.P256,HardwareProtected true};KeyVaultKey ecKey await client.CreateEcKeyAsync(ecOptions);加密和解密示例byte[] plaintext Encoding.UTF8.GetBytes(Secret message to encrypt);// 加密EncryptResult encryptResult await cryptoClient.EncryptAsync(EncryptionAlgorithm.RsaOaep256,plaintext);// 解密DecryptResult decryptResult await cryptoClient.DecryptAsync(EncryptionAlgorithm.RsaOaep256,encryptResult.Ciphertext);string decrypted Encoding.UTF8.GetString(decryptResult.Plaintext);签名和验证示例byte[] data Encoding.UTF8.GetBytes(Data to sign);// 签名数据内部计算哈希SignResult signResult await cryptoClient.SignDataAsync(SignatureAlgorithm.RS256,data);// 验证签名VerifyResult verifyResult await cryptoClient.VerifyDataAsync(SignatureAlgorithm.RS256,data,signResult.Signature);Console.WriteLine($Signature valid: {verifyResult.IsValid});密钥轮换// 轮换密钥创建新版本KeyVaultKey rotatedKey await client.RotateKeyAsync(my-rsa-key);// 设置轮换策略KeyRotationPolicy policy new KeyRotationPolicy(){ExpiresIn P90D // 90天后过期};policy.LifetimeActions.Add(new KeyRotationLifetimeAction{Action KeyRotationPolicyAction.Rotate,TimeBeforeExpiry P30D // 过期前30天轮换});await client.UpdateKeyRotationPolicyAsync(my-rsa-key, policy);最佳实践使用DefaultAzureCredential进行身份验证在Azure托管的应用程序中使用托管标识启用软删除以便恢复使用RBAC进行细粒度访问控制定期轮换密钥以增强安全性为关键密钥启用HSM保护备份重要密钥以防数据丢失监控密钥使用和过期时间局限性仅当任务明确符合上述范围时使用此技能不要将输出视为环境特定验证、测试或专家审查的替代品如果缺少必需的输入、权限、安全边界或成功标准请停止并请求澄清